Ge SD9 Firmware vulnerabilities

5 CVEs affecting Ge SD9 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-24120, published 2022-12-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-24119, published 2022-12-26. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device configuration shell. This affects iNET and iNET II before 8.3.0.
CVE-2022-24118, published 2022-12-26. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the factory default configuration. This affects iNET and iNET II before 8.3.0, SD before…
CVE-2022-24117, published 2022-12-26. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Certain General Electric Renewable Energy products download firmware without an integrity check. This affects iNET and iNET II before 8.3.0, SD before 6.4.7, TD220X before 2.0.16, and TD220MAX before…
CVE-2022-24116, published 2022-12-26. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. Certain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II before 8.3.0.
CVE-2022-24120, published 2022-12-26. Medium severity, CVSS 4.6. EPSS: 0.2% chance of exploitation in the next 30 days. Certain General Electric Renewable Energy products store cleartext credentials in flash memory. This affects iNET and iNET II before 8.3.0.